linux-kernel - [GIT PULL] x86/tdx for 6.14-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250122002751.2321863-1-dave.hansen@linux.intel.com>
Date: Tue, 21 Jan 2025 16:27:51 -0800
From: Dave Hansen <dave.hansen@...ux.intel.com>
To: torvalds@...ux-foundation.org
Cc: x86@...nel.org,
	linux-kernel@...r.kernel.org,
	Dave Hansen <dave.hansen@...ux.intel.com>
Subject: [GIT PULL] x86/tdx for 6.14-rc1

Hi Linus,

Please pull some x86/tdx changes for 6.14-rc1.

The existing TDX code needs a _bit_ of metadata from the TDX module.
But KVM is going to need a bunch more very shortly. Rework the
interface with the TDX module to be more consistent and handle the
new higher volume.

The TDX module has added a few new features. The first is a promise
not to clobber RBP under any circumstances. Basically the kernel now
will refuse to use any modules that don't have this promise. Second,
enable the new "REDUCE_VE" feature. This ensures that the TDX module
will not send some silly virtualization exceptions that the guest had
no good way to handle anyway.

--

The following changes since commit 40384c840ea1944d7c5a392e8975ed088ecf0b37:

  Linux 6.13-rc1 (2024-12-01 14:28:56 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git tags/x86_tdx_for_6.14-rc1

for you to fetch changes up to 6f5c71cc42d49203771bceed91a023d4dbec54f4:

  x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation (2024-12-18 14:36:02 -0800)

----------------------------------------------------------------
 * Centralize global metadata infrastructure
 * Use new TDX module features for exception suppression and RBP
   clobbering

----------------------------------------------------------------
Kai Huang (5):
      x86/virt/tdx: Rename 'struct tdx_tdmr_sysinfo' to reflect the spec better
      x86/virt/tdx: Start to track all global metadata in one structure
      x86/virt/tdx: Use dedicated struct members for PAMT entry sizes
      x86/virt/tdx: Switch to use auto-generated global metadata reading code
      x86/virt/tdx: Require the module to assert it has the NO_RBP_MOD mitigation

Kirill A. Shutemov (2):
      x86/tdx: Disable unnecessary virtualization exceptions
      x86/tdx: Dump attributes and TD_CTLS on boot

Paolo Bonzini (1):
      x86/virt/tdx: Use auto-generated code to read global metadata

 arch/x86/coco/tdx/Makefile                  |  2 +-
 arch/x86/coco/tdx/debug.c                   | 69 +++++++++++++++++++++
 arch/x86/coco/tdx/tdx.c                     | 44 ++++++++++---
 arch/x86/include/asm/shared/tdx.h           | 38 +++++++++++-
 arch/x86/include/asm/tdx.h                  |  3 +
 arch/x86/virt/vmx/tdx/tdx.c                 | 95 ++++++++++-------------------
 arch/x86/virt/vmx/tdx/tdx.h                 | 40 ++----------
 arch/x86/virt/vmx/tdx/tdx_global_metadata.c | 48 +++++++++++++++
 arch/x86/virt/vmx/tdx/tdx_global_metadata.h | 25 ++++++++
 9 files changed, 252 insertions(+), 112 deletions(-)
 create mode 100644 arch/x86/coco/tdx/debug.c
 create mode 100644 arch/x86/virt/vmx/tdx/tdx_global_metadata.c
 create mode 100644 arch/x86/virt/vmx/tdx/tdx_global_metadata.h